EU AI Act Labeling and Watermark Rules: What SMBs Must Do

On 2 August 2026, the part of the AI Act that affects anyone making content with AI comes into force: the transparency obligations. If you publish posts, images or videos that AI generated or edited, or you run a chatbot, you need answers to two questions. Does this piece of content need a label? And who adds it, you or the company behind the tool?

On 10 June 2026 the European Commission published a code of practice, updated two days later, with concrete measures to help providers and deployers meet the obligations that apply from 2 August 2026.¹ Below is a process for getting compliant without panicking and without an in-house legal team, plus the mistakes small business owners make most often.

What actually changes on 2 August 2026

From 2 August 2026, the AI Act requires clear labelling in a few key cases. Deepfakes, and AI-generated or AI-manipulated text published on matters of public interest, must be clearly labelled.¹

The stated aim is practical. People should be able to tell when content has been generated or altered by AI, which cuts the risk of deception and manipulation.² The rule exists to protect the trust of whoever reads your content, watches it or contacts your brand.

The Commission’s code is voluntary. It sets out practical measures for both providers and deployers of generative AI systems.¹ Voluntary means you don’t have to sign up to it. The transparency obligations underneath it apply from that date either way.

Watermark or label: the misunderstanding that costs the most

In all likelihood, your business does not need to build a technical watermark. The EU code sets out practical measures for the company that builds the generative AI system (the provider) and for the business that uses it day to day (the deployer).¹

Your job is to make it clear and visible that a deepfake, or a text on a matter of public interest, involved AI.¹

For the visible part, pick one recognisable label and use it every time. That saves you inventing a new symbol for each piece and then explaining it. If an outside supplier makes your videos, settle at the quote stage who signs off the Design Team Credits and who adds any AI notice to the end credits.

Provider or deployer: your role decides what’s on you

The AI Act treats people differently depending on where they sit. It covers five roles along the value chain: provider, deployer, importer, distributor and authorised representative.³ Working out which one you are comes first, because your obligations depend on it.

A small business creating content with third-party tools is almost always a deployer. If you substantially customise a system, or put it back on the market under your own brand, check carefully which role you’ve stepped into. Your position in the chain can shift.

Responsibility rarely sits with one party anyway. Because each role in the chain is separate, it’s worth putting in writing who answers for what whenever you work with an agency or a freelancer.

Here’s a prompt to help pin down roles, using an AI assistant to speed things up:

“Act as a compliance consultant. I’ll describe how my company uses a generative AI tool for [describe the use: social images, blog copy, video, chatbot]. Set out in a table whether I’m a provider or a deployer, which transparency obligations apply to me, which stay with the tool’s provider, and three questions I should put to my supplier in writing.”

Always check what the model gives you. It doesn’t replace proper legal advice.

How we got here, and why the date matters

The AI Act is an EU regulation that creates a common legal framework for artificial intelligence, making the EU the first institution in the world to adopt rules of this kind.⁴ It took a while. The Commission proposed the text on 21 April 2021, the European Parliament voted it through on 13 March 2024, and the Council of the EU approved it on 21 May 2024.⁴

Adoption by the 27 member states on 13 March 2024 closed a process that began in 2021, with milestones along the way such as the Council’s position in December 2022 and the provisional agreement in December 2023.⁵ The application deadlines now build on that approved framework, including 2 August 2026 for the transparency obligations on content.¹

What to label, asset by asset

Which of your content actually falls under the obligation? The key cases named are deepfakes and AI-generated or AI-manipulated text on matters of public interest.¹ Outside those cases, disclosing AI use is still good reputational hygiene.

Try it against the things you actually publish:

• A hyper-realistic image showing a person or an event in a believable but false way falls under the deepfake logic and needs flagging.
• An article on a public-interest topic written or reworked by AI needs a label.
• For a chatbot on your website, it’s good practice to make it obvious from the first message that people are talking to a machine.
• A product photo with the brightness tweaked, or an internal operational document, falls outside the key cases.

Watch out for what doesn’t count as a label. A notice tucked away at the bottom of your terms and conditions, or left only in invisible metadata, makes nothing “clear” to the person looking at it. The EU code is built around the audience recognising AI origin, so the disclosure has to sit where people will actually see it.²

How much you stand to lose under AI Act penalties

The maximum fines are eye-watering. Penalties come in three tiers and go up to €35 million or 7% of worldwide annual turnover.³ Those figures are aimed at the most serious breaches, typically the prohibited practices. A social caption missing an icon is nowhere near that.

Article 5 lists eight prohibited practices, and that’s where the penalties really bite.³ For a business using AI for legitimate marketing, the realistic risk is getting transparency wrong. Serious violations are a different category altogether.

Getting compliant in five steps

Compliance is a process you can repeat. A route consistent with the regulation has five stages: an inventory of your AI systems, risk classification, gap analysis, remediation and ongoing monitoring.³ Run it once before 2 August 2026, then again at fixed intervals.

1. Inventory. List every point where AI touches your content: text, image, video and voice generators, the chatbot, editing tools. Without that map, you don’t know what to label.
2. Risk classification. The AI Act uses a four-tier risk classification.³ Put each use in the right tier. Generative marketing almost always lands in the transparency-obligations zone.
3. Gap analysis. Compare your inventory with the cases that need a label: deepfakes and public-interest text.¹
4. Remediation. Add visible disclosure where it’s needed, and update your contracts with suppliers and agencies.
5. Monitoring. Every new tool you adopt goes into the inventory.

A prompt to speed up the inventory stage while you stay in charge of the process:

“You’re a process analyst. Help me build a register of AI-generated content for a small business. Create a table with these columns: asset, tool used, AI’s role (generation or editing), publishing channel, falls into a labelling case (deepfake / public-interest text / chatbot) yes or no, planned disclosure wording, internal owner. Then ask me 8 questions so I can fill it in row by row.”

Ready-to-use disclosure microcopy

Disclosure works when it’s short and in the right place. Here are four starting points to adapt to your tone. No icons required, but all in line with the clarity the EU code is after.²

• Chatbot, first message: “Hi, I’m an automated assistant. My replies are generated by AI. If you’d rather talk to a person, type ‘agent’.”
• Social caption on a synthetic image: “Image generated with AI.”
• Footer on a public-interest article: “Written with the help of AI tools and reviewed by our editorial team.”
• Video credits: “Content created with generative AI.”

Keep these standard lines in a single document and make one person responsible for applying them. The SOP matters more than any single phrase. Once it exists, labelling happens on autopilot and nobody has to decide from scratch each time.

The AI Act, GDPR and the rules that overlap

The AI Act doesn’t sit on its own. Academic analysis of the regulation traces its links to other key pieces of EU law, including the Digital Services Act, the Digital Markets Act and the GDPR.⁶ If your marketing uses personal data for profiling or personalisation, privacy compliance still runs alongside it and still applies.

The framework also keeps moving. EU rules on AI are still evolving. For a small business, the practical takeaway is to treat your content register as a living document and review it, rather than ticking compliance off once and forgetting it.

On enforcement, the regulation sets up dedicated governance bodies, a topic the academic commentary covers in its own right.⁶ It’s worth finding out early who the supervising authority is in your country.

Fonti

Footnotes

1. La Commissione pubblica un codice di buone pratiche sulla … digital-strategy.ec.europa.eu ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

2. Commission publishes Code of Practice on marking and … digital-strategy.ec.europa.eu ↩ ↩² ↩³

3. EU AI Act Compliance Guide 2026. books.google.co.id ↩ ↩² ↩³ ↩⁴ ↩⁵

4. Legge sull’intelligenza artificiale — Wikipedia. it.wikipedia.org ↩ ↩²

5. Navigating the European Union Artificial Intelligence Act for Healthcare. nature.com ↩

6. The EU Artificial Intelligence Act: A Thematic Commentary. play.google.com ↩ ↩²